ICAS 2000 CONGRESS

EFFECT OF AIRCRAFT FAILURES ON USAF

STRUCTURAL REQUIREMENTS†
John W. Lincoln
United States Air Force
Keywords: fatigue, damage tolerance, widespread fatigue damage
Abstract design the fuselage for the pressure differential
at high altitudes and to design the wings and
Structural failures in both commercial and
empennages to operate in turbulence dominated
military aircraft have been the primary factor
low level regime. However, since they did not
that has changed rules and specifications that
understand the implications of these
engineers use for design. In many cases, the
environments, they generally did not properly
failures have identified threats to structural
establish the design of the aircraft components
integrity that were not previously identified by
to withstand them. The design community
the certification authorities. Commercial
appeared oblivious to the consequences of
failures have influenced the military
ignoring threats to structural integrity other than
specifications and the military failures have
overload. The success they had experienced
influenced the commercial aircraft rules. The
with earlier designs indicated to them that they
experience derived from the individual failures
were immune to failure from fatigue. Many
is used to describe the lessons learned and to
early textbooks on aircraft structural analysis
illustrate the evolution of structural criteria that
indicated the designers job was complete when
the United States Air Force (USAF) uses for
they satisfied the static strength requirements.
procurement of new aircraft.
They made no mention of potential for fatigue
failures. This omission resulted in grave
1 Introduction consequences.
Today, structural failures in USAF aircraft are Increased performance demands pressured
extremely rare. Except for those failures the design community to design aircraft at too
derived from exceeding the operational high of a stress for materials that had marginal
envelope of the aircraft, this was true for ductility. One of the major failures resulting
structural failures until after the mid-forties. from increased performance demands was the
One reason for this is early aircraft rarely Martin 202. This aircraft failed on 29 August
accumulated sufficient flight time aircraft to 1948 from fatigue cracking in the wing.
suffer from fatigue failures. Further, ductile Another important commercial aviation failure
materials and conservative methods used for occurred in the Comet [1]. There were two
analysis tended to preclude failures. Therefore, failures. The first occurred 10 January 1954 and
the designers were led to believe the only threat the second occurred on 8 April 1954. These
to structural integrity was failure resulting from failures ushered in the requirements for fail-
loading the aircraft beyond its ultimate strength. safety in large commercial transport aircraft.
The demand for improvements in performance Another important commercial aircraft
in the late forties introduced new materials with failure was the Boeing 707 horizontal tail
high strength, but few other virtues. Further, the failure. This failure demonstrated that structural
demand for performance improvements reduced inspections were required in addition to fail-safe
analytical conservatism and introduced designs requirements resulting from the comet disasters.
that were to operate in diverse environments. In There are many USAF aircraft failures that
some cases, the structural engineers needed to one could use to illustrate important changes in
†
This paper is a work of the U.S. Government and is not subject to copyright protection in the United States.

442.1
 John W. Lincoln

either standards or specifications. One of these its maximum speed was 981 kilometers per
is the F-4 accident at Nellis Air Force Base, hour. It was powered by six General Electric
Nevada on 23 January 1973. This failure J47 engines each with a thrust of 32,027
conclusively demonstrated to the USAF that a Newtons. The USAF did not specify a service
structure was not fail-safe unless there was an life, but they intended to maintain the aircraft in
inspection program designed to find the broken service until 1965. The engineers based the
member before the secondary load path failed. design on the premise that failure from overload
Another important failure occurred in the T-38 was the only threat to its structural integrity.
aircraft when the training command changed Fatigue failures of this aircraft demonstrated the
their usage dramatically without advising the fallacy of this premise. On the same day, 13
maintenance center engineers. Consequently, March 1958, in separate incidents, two of these
changes in inspection intervals were not aircraft suffered failure because of fatigue.
implemented. However, three aircraft had Near Homestead Air Force Base, Florida, a
profound effect on the way the USAF B-47B disintegrated at 15,000 feet, three
accomplishes its mission today. The first is the minutes after takeoff. Its center wing section
B-47 that led to the USAF Aircraft Structural failed at approximately buttock line 45. The
Integrity Program (ASIP). The second is the aircraft had a total flight time of 2,077 hours at
F-111 that led to the adoption of damage the time of failure. The same day, a TB-47B
tolerance in the USAF. The third is the KC-135 failed at 23,000 feet over Tulsa, Oklahoma,
that led to a process for assessing widespread after the lower left wing failed at buttock line
fatigue damage (WFD). 35. This aircraft had flown 2,418 hours. While
the USAF and the contractor were investigating
2 The B-47 the two 13 March accidents, three more failures
followed. This indicated the 13 March failures
The catastrophic events leading to the were not isolated events. The USAF attributed
establishment of the USAF ASIP in 1958 [2] are one of these three to overload. They believed
well-documented [3]. Of these events, the B-47 the other two were caused from fatigue. One of
fatigue failures stand out as the most significant. these aircraft appeared to explode at 13,000 feet
These problems crippled the main striking force just prior to a refueling rendezvous near
of the Strategic Air Command at a time of Langford, New York on 10 April. On 15 April,
extreme world tension. The B-47 and other a B-47E with a total flight time of 1,419 hours
aircraft provided the hard lesson that aircraft took off into a storm from McDill Air Force
designed based on static strength alone would Base, Florida and disintegrated shortly
likely not reach their planned service life. afterwards.
The prototype of the B-47 made its first The USAF approached the solution of this
flight on December 17, 1947. The USAF problem through flight restrictions, and a test
accepted the aircraft based on a static test of the program as well as additional inspections and
B-47B in 1950 and started quantity production instrumentation. They placed flight restrictions
in 1951. There was a flight load survey on aircraft mass, airspeed, and load factor. The
demonstration of a B-47B from September 1952 test program included independent cyclic tests
to March 1954. When production ended in in three laboratories. The USAF contracted for
1957, more than 1,200 of these aircraft were these tests at the Boeing plant in Wichita,
serving with the Strategic Air Command at Kansas, the Douglas plant in Tulsa, Oklahoma,
USAF bases throughout the world. The B-47 and the National Advisory Committee for
normally carried a crew of three - pilot, copilot Aeronautics (NACA) laboratory at Langley,
(who operated the tail turret by remote control), Virginia. To the surprise of the USAF, the test
and an observer who also served as navigator, at Boeing revealed a new fatigue critical
bombardier, and radar operator. The maximum location at fuselage station 508. The test article
mass of the aircraft was 102,494 kilograms and failed after 1,275 cyclic test hours. Although

442.2
 EFFECT OF AIRCRAFT FAILURES ON USAF STRUCTURAL REQUIREMENTS

the USAF specified the laboratories to conduct within the design service goal for the aircraft.
the tests with identical spectra, there were Tests of components representative of
significant differences in the test results. The production determine the variability of the
tests, however, served their purpose by quality of the structure and consequently the
identifying areas that the USAF must modify in scatter factor needed to interpret full-scale
operational B-47 aircraft. By the late 1960s, the fatigue test results. Either the log normal
B-47 was obsolete and was removed from distribution function or the Weibull distribution
operational service. function is typically used to represent the
The USAF was unsure whether the B-47 reliability of the structure. The development [4]
failures indicated a chronic problem in all Air of the reliability function for the Weibull
Force aircraft. To answer this question the distribution function provides the basis for the
USAF Chief of Staff, General Curtis LeMay reliability calculation.
gave informal approval on June 12, 1958 to For aluminum structures, the Weibull
proceed with a program called the “Aircraft shape number is typically in the interval of
Structural Integrity Program” as proposed by [4.0,6.0]. Therefore, if the Weibull shape
the Wright Air Development Center (WADC). number is 6.0, then the test scatter factor needs
The primary objectives of this program were the to be approximately 3.5 to demonstrate the
following: desired reliability. However, for high strength
(a) Control structural fatigue in the steel, the Weibull shape number is in the
operational aircraft fleet. interval of [2.0,3.0]. For a Weibull shape
(b) Devise methods of accurately predicting number of 3.0, the test scatter factor may need
aircraft service life. to as high as 13.0 to demonstrate the desired
reliability [5].
(c) Provide the required design process and Data derived from tests indicate that, in
test techniques that would avoid structural
addition to the material influence on the Weibull
failures in operational aircraft.
shape number, there is spectrum content effect
A later policy directive issued by General
on this number. For example [6], test results
LeMay on November 19, 1958 formalized the
with a fighter spectrum appear to have a
program. The USAF initially defined the detail
significantly higher Weibull shape number than
requirements in ASD-TN-61-141.
test results with a constant amplitude spectrum.
The 1958 ASIP included a requirement that
Further, it is not possible to determine the
an aircraft be designed to withstand the repeated
quality of the test article in relation to the
loads expected during its service life. As
population of production aircraft. The potential
validation that this requirement was met, the
exists that manufacturing or service induced
aircraft was subjected to a laboratory (fatigue)
damage in some members of the population may
test that simulated its expected service loading.
violate the basic premise of the reliability
The period for which the aircraft would be
concept. All of these influences make it
declared safe to operate (the safe life) was the
extremely difficult to determine the reliability
equivalent flight time to failure in the fatigue
demonstrated by the full-scale fatigue test.
test divided by a scatter factor, usually four.
Therefore, a fighter aircraft, which a
manufacturer designed for an operational life of 3 The F-111
4,000 hours would have to successfully pass a The F-111 was originally known as the TFX
laboratory durability test of 16,000 hours. (Tactical Fighter "X"), and was conceived to
The safe life approach is based on meet the USAF requirement for a new tactical
probabilistic methods. The structural engineer fighter-bomber. In 1960, the Department of
selects materials and designs individual Defense (DoD) combined the USAF's
members of the structure based on a failure rate requirement with a Navy need for a new air
such that operationally no failures are expected superiority fighter, and initiated a competition

442.3
 John W. Lincoln

among aircraft manufacturers for the final fabricated from heat-treated D6ac steel that
design. In 1962, General Dynamics and Boeing included welds. Most components were heat
were selected as finalists with the General treated to an ultimate tensile strength of 1520-
Dynamics TFX design eventually winning. 1660 MPa with the upper surface of the carry-
DoD awarded the contract to them on December through box and access door heat treated to
21, 1962, to design and build this aircraft. The 1790-1930 MPa. These components were
USAF version was known as the F-111A and typically forged and then welded into the
the Navy version the F-111B. The F-111A was desired assemblies. The manufacturer
powered by two Pratt & Whitney TF30-P103 machined some of them, however, from rolled
turbofans. The early F-111A engines had plate stock.
extremely bad compressor surge and stall However, the design, development, and
problems. The Navy was never enthusiastic certification of the F-111 structure followed the
about this program. The F-111B was quite principles defined in ASD TR 66-57 “Air Force
heavy for carrier operations and the Navy Aircraft Structural Integrity Program: Airplane
cancelled the program when it failed to meet the Requirements.” The USAF published this
requirement for handling on an inclined deck. document following the policy change resulting
The first flight of the F-111A took place in from the B-47 failures. Consequently, it was
December 1964, and the first production models qualified for life through the safe life
were delivered to the USAF in October of 1967. methodology by means of fatigue testing. Many
The variable sweep wings were able to move failures slowed the testing of the aircraft, which
from 16 degrees (full forward) to a sweep angle began in August 1968. After only a few
of 72.5 degrees (full aft). The two hundred hours, the wing carry-through box
crewmembers sat side-by-side in cockpit failed due to fracture of a Taper-Lok bolt in the
module that served as an emergency escape rear spar web. The investigation following this
vehicle. Using internal fuel only, the plane had failure led to improvements in the installation of
a range of more than 4,000 kilometers. External these fasteners. The second failure occurred in
fuel tanks could be carried on the pylons under the wing carry-through box in February 1969.
the wings and jettisoned if necessary. The This failure occurred in a straight hole used to
USAF aircraft was produced in a variety of mount a bracket. Inspections of 23 similar holes
models, including the F-111A, F-111D, F-111E, in the structure revealed additional cracking.
and F-111F, as well as the FB-111A strategic The contractor modified these holes to accept
bomber version. The FB-111A aircraft had a the fatigue resistant Taper-Lok fastener. The
1.07-meter increase in wing span and used the USAF then tested a new test article that
TF30-P-7 engine. In all, 563 F-111s of all incorporated all of the modifications from
series were built. All of the F-111s had previous test findings. This article failed in
numerous problems, and only the F-111F June 1969 with 8,000 equivalent test hours. The
actually fulfilled the original TFX design failure was located in the outboard closure
specification. The F-111F had an empty mass bulkhead of the wing carry-through box. A
of 21,367 kilograms and a maximum takeoff simple modification eliminated this problem.
mass of 45,000 kilograms. The F-111F was The contractor continued testing successfully
able to reach Mach 1.2 at sea level and Mach with a new wing box until the test article
2.5 at 60,000 feet. All F-111s were retired from reached 16,000 simulated flight hours. The
the USAF inventory on 27 July 1996. USAF interpreted the test, in which the
The demand for high performance from spectrum was more severe than expected in
this aircraft placed great demand on the operational service, as meeting a 6,000-hour life
structural mass of the aircraft. The constraints with a scatter factor of four.
to produce a minimum mass design with a The USAF subsequently accepted the
variable wing sweep were met with monolithic aircraft for operational service. On December
wing pivot and wing carry-through box 22, 1969, F-111A Number 94 (SN 67-049)

442.4
 EFFECT OF AIRCRAFT FAILURES ON USAF STRUCTURAL REQUIREMENTS

crashed as a result of a wing failure in the lower inspection of steel structures since cooling
plate of the left wing pivot fitting. At the time reduces the fracture toughness of steel.
of failure, the aircraft had approximately 100 Consequently, the reduced fracture toughness
hours of flight time. It occurred during a pull- reduces the critical crack size. Thus, if a
up from a rocket-firing pass at the Nellis Air structure has a crack of critical size at the
Force Base, Nevada range. The USAF reduced temperature, it will fail under the proof
immediately grounded all F-111 aircraft and load condition. If it does not fail, then the
sent the failed part to General Dynamics. structure does not have a crack of this size or
Metallurgical examination showed that the greater. Consequently, when the operating
manufacturing process had produced a defect temperature exceeds the proof test temperature,
that served as a nucleation site for a fatigue the number of failure-free flight hours may be
crack. The principal evidence of this was the easily determined.
presence of a decarburized zone at the surface The USAF funded the building of a proof
of the flaw and iron oxides on the fracture face. test facility at General Dynamics in Fort Worth,
These findings are characteristic of the high Texas and at the Sacramento Air Logistics
temperatures associated with forging and heat Center, California. The initial proof testing was
treatment. The metallurgists believed that this completed in February 1972 on 340
flaw was the result of a cooling crack that F-111A/D/E and FB-111A aircraft.
occurred after the final forging cycle. The proof test process was repeated after
Normally, the manufacturer detects and approximately 1,500 flight hours. Since the
removes this type of crack before proceeding proof test program started in 1970, there have
with further steps in the fabrication process. been 11 major failures in proof testing. The
The inspection procedures used included defects that led to these failures could have
ultrasonic pulse echo transmission, conventional caused an in-flight catastrophic failure. When
magnaflux, and x-ray. Because of the size and failures occurred during proof testing, the USAF
unusual geometry of the part, the flux field responded as if an in-flight failure had occurred.
applied during the magnetic particle inspection They initiated fleet-wide inspections and made
was inadequate to cause the migration of the modifications where appropriate. These proof
iron particles to the flaw. In addition, the test failures proved the lack of validity of the
ultrasonic inspection could not detect a flaw safe life methodology for the steel alloys used in
with the orientation to the surface as had existed this aircraft. Each of the aircraft suffering a
on the crashed aircraft. X-ray was probably proof test failure would have experienced an in-
ineffective because of the tightness and service failure in less time than that validated by
orientation of the defect. Consequently, the previous fatigue testing.
manufacturer did not detect this flaw as it There was some justification for believing
passed through the fabrication process. the flaw found in the 1969 failure to be unique
The USAF established the Phase I since the USAF could not reproduce the failure
“Recovery Program” in February 1970 to in the laboratory and did not see such a failure
restore the fleet to 80 percent of design on another F-111 aircraft. In addition, if the
capability. This program included a proof test F-111 incident had been the only failure of the
loading of each aircraft to design limit load safe life approach, the USAF would have likely
(+7.33g and -2.4g) at a wing sweep of 56 rationalized the F-111 wing pivot flaw as a one-
degrees and a temperature of –40° C. A USAF of-a-kind event and continued with this method.
Scientific Advisory Board Panel introduced the From other problems in the USAF aircraft,
concept of cold proof test. C. Tiffany, a however, it had become evident that the safe life
member of this panel, had previously methodology had not precluded the use of low
successfully used cold proof testing in the space ductility materials operating at high stresses.
program for the inspection of steel fuel tanks. The safe life also had not recognized that any
This is an extremely useful tool for the single aircraft might have "rogue"

442.5
 John W. Lincoln

manufacturing or service-induced defects that This technology is also suitable for application
could lead to premature failure. to new aircraft developments. Consequently,
The recovery program for the F-111 was the USAF was able to include damage tolerance
the first major application of damage tolerance requirements in the specification for new
concepts to aircraft. aircraft procurement.
The USAF significantly changed its The level of safety afforded by the DTA
structural integrity program because of the process has proven through service experience
failure of an F-111 in 1969. Up to that time, the to be high. However, it is evident that the
USAF had been concentrating on improvement probability of having an initial defect larger than
in reliability methods to maintain flight safety of the rogue flaw is considerably less than
their aircraft. In addition, they were examining probability of missing a significant crack in the
the potential for using the fracture mechanics structure through an inspection. Therefore, for
based approach called damage tolerance [7]. aircraft that are approaching a state of general
The F-111 failure provided the basis for the cracking or their economic life, it is prudent to
decision on which path they would take. It re-examine the damage tolerance derived
ushered in the era of damage tolerance in the inspection intervals to determine if they should
USAF [8]. The first assessments performed on be reduced. This may be done by means of a
the C-5A and the B-1A in 1971 and 1972 helped risk assessment [10]. Extensive cracking is not
derive the original damage tolerance assessment expected to be a problem for recently developed
(DTA) requirements for the USAF. These USAF aircraft since they were designed for two
requirements were derived for monolithic (i.e., lifetimes of slow crack growth from a 1.27 mm
slow crack growth) structures. The failure of an initial flaw. This two lifetime slow crack
F-4 wing, previously mentioned, also strongly growth guidance is included in the JSSG 2006
influenced the damage tolerance requirements specification guide for structures.
as initially established in MIL-A-83444. The A number of benefits have been derived
technology for the analysis of fail-safe designs from the DTA process. One of the more
has evolved slowly, primarily because of the significant benefits is that it has placed the
need for extensive finite element programs USAF in an active mode of problem
supported by expensive test programs. The identification rather than the reactive mode that
change to a damage tolerance approach prevailed in the sixties and early seventies. This
prompted considerable research and has permitted the Air Logistics Centers to make
development in the area of fracture mechanics. long range plans for inspections and
At that time Air Force Flight Dynamics modifications of their aircraft. Further, the Air
Laboratory was the focal point for much of this Logistics Centers now have specific inspection
research. In the sixties and seventies, they requirements (i.e., the how, when and where to
developed much of the fracture technology that inspect). Consequently, the logistics
is still in use today. In addition, since the community has enthusiastically embraced the
damage tolerance approach forced the engineer DTA process. This acceptance has significantly
to better understand the stresses in the structure, enhanced its success.
finite element techniques emerged as the
method of choice for the stress analysis. These 4 The KC-135
capabilities permitted the USAF to perform a
DTA of all the major weapon systems in the The KC-135, a tanker aircraft that followed the
inventory in the seventies and eighties [9]. This KC-97, was designed to refuel the B-52 fleet.
effort required over one million man-hours to The KC-135 was derived from an aircraft
complete and every major manufacturer was designated as the 367-80 developed by the
involved with this activity. Because of this Boeing Company with their own funds. The
activity, industry was able to develop the Boeing 707 and 720 were also derived from the
technology required for this type of analysis. 367-80 design. The first flight of a KC-135

442.6
 EFFECT OF AIRCRAFT FAILURES ON USAF STRUCTURAL REQUIREMENTS

occurred 31 August 1956. Five other loads. The 1962 test included an application of
configurations of this aircraft were delivered ninety percent of limit load every 200 flights.
before production was terminated in 1965 after The 1972 test included the application of sixty-
820 aircraft had been manufactured. Thirty- two percent of limit load every 200 flights.
seven different designations of the -135 aircraft Because of the retardation effect of the ninety
now exist. The maximum takeoff mass is percent limit load application, the 1972 test
146,285 kilograms and the fuel transfer load is exhibited earlier and more cracking than
90,719 kilograms. It is powered by four exhibited by the 1962 test. In fact, 367 cracks
CFM-International F108-CF-100 turbofan were found in the 1962 test article and 1060
engines in the KC-135R configuration and four cracks were found in the 1972 test article.
Pratt & Whitney TF-33-PW-102 turbofan However, as with the 1962 test, there was poor
engines in the KC-135E configuration. The time correlation of the cracks occurring on the
thrust for the CFM engine is 996,233 Newtons fatigue test article and those occurring in
and 80,068 Newtons for the TF-33 engine. operational aircraft. The wing of the 1972 test
The KC-135 did not have a design service article failed catastrophically at 55,505 cyclic
life originally specified. In 1962, the USAF test hours. Based on the results of the 1972 test,
made a decision to perform a fatigue test to the USAF determined that the lower wing
better quantify the expected life. This test was surface would need to be replaced at 13,000
conducted to failure of the wing at 55,080 test equivalent tanker hours. The results of this test
hours of a tanker mission of 5.1 hours. Based also alerted them to the possibility that the fail
on this test, it was believed that a service life of safety of the wing structure could be degraded
13,000 hours could be achieved if certain by the presence of WFD [11].
modifications were performed. These Since some aircraft were near or already
modifications consisted of reworking over the threshold of 13,000 equivalent tanker
approximately 2,000 fastener holes. hours, a decision was made to replace the lower
Contradictory to the 1962 fatigue test wing surface on these aircraft. Further, since
results, the KC-135 aircraft experienced service the only available design at that time was the
problems early in its life. The 7178-T6 lower original 7178-T6 wing, that material was used
wing skins were designed with stresses for the replacement. This was done for twenty-
approximately fifty percent higher than the 707 nine wings. This replacement was questionable
aircraft which had the higher toughness because it was accomplished with the same
2024-T3 alloy for the lower wing skins. brittle material. However, it is likely that it did
Consequently, aircraft operating between 1,800 enhance the safety of the aircraft and, in
and 5,000 flight hours had experienced fourteen addition, provided wings for teardown
cases of unstable cracking in the lower wing inspections.
skins. In all, there have been approximately The teardown inspections of six wings
thirty cases on unstable cracking in the range of removed for a wing skin replacement served as
1,800 to 17,000 flight hours. The longest of the basis for an assessment of the influence of
these cracks was approximately 1.1 meters. crack pairs. A crack pair was defined as a
In addition to these problems, by 1968, it primary and secondary crack located such that
had become evident that a service life of 13,000 an unstable primary crack could cause the
hours would not be adequate for this aircraft. secondary crack to go unstable and therefore
Therefore, in 1972, another fatigue test was precipitate catastrophic failure of the wing. In
performed to determine the actions required for other words, the assessment was made for
extending the life beyond 13,000 flight hours. determining the degradation of the fail safety of
This test was significantly more sophisticated the wing because of WFD. Finite element
than the earlier 1962 test and was more analyses of the wing have shown that
representative of actual force usage. One of the approximately twenty fastener holes are
main differences was in the application of high subjected to significantly higher stresses in the

442.7
 John W. Lincoln

event of failed skin element. If there were a replacement was successfully performed
crack of one millimeter in one of these fastener without loss of an aircraft.
holes then the residual strength would have been WFD is a major concern in aircraft since it
reduced to a level considerably below limit can destroy the fail-safety that the operator
load. A risk analysis for the wing was relies on to maintain structural integrity. This
conducted by R. Meadows from the Oklahoma phenomenon has occurred on many aircraft,
Air Logistics Center located at Tinker Air Force both military and commercial. The USAF has
Base, Oklahoma. The database included 245 learned WFD can degrade the fail-safe
cracks, each of which were 1.27 millimeters or capability of a structure with cracks that are of
longer in length. In addition, 29 crack pairs the order of one millimeter in length [12].
were found which for the purposes of this study The onset of WFD in a structure is
were defined as 1.27 millimeters in length for characterized by the simultaneous presence of
the primary crack and 0.254 millimeters in cracks at multiple structural details, which are
length for the secondary crack. Meadows used of sufficient size and density whereby the
the most critical crack pair from each aircraft structure will no longer meet its damage
for his evaluation. The results of this tolerance requirement. This means that the
examination showed that the mean time for a structure is incapable of maintaining its required
crack pair to develop was 10,709 to 15,441 residual strength after partial structural failure.
flight hours with ninety five percent confidence. In many cases, this deterministic definition is
Based on these results, Meadows performed a difficult to apply because of the complex
risk assessment and found that by the time the cracking scenarios. Further, this definition may
fleet of aircraft had reached a life of 13,000 lead to an excessively conservative
flight hours, he expected, at best, one loss and, determination of the time of onset of WFD. An
at worst, fourteen losses. He also concluded alternate definition that removes these problems
that the degradation of fail safety started at is the following: The onset of widespread
about 11,000 flight hours. fatigue cracking is that point in the operational
Another teardown inspection of an aircraft life of an aircraft when the damage tolerance or
with 11,558 flight hours indicated multiple fail-safe capability of a structure has been
crack alignment at the Wing Station 360 splice. degraded. The degradation is such that after
Boeing determined that this splice, which is a partial structural failure the probability of
known area of high stress, would have failed failure of the structure falls below the thresholds
catastrophically with the application of seventy specified by the procuring (or certification)
percent of limit load. In December 1976, a agency.
VC-135B was in the depot for replacement of For the USAF, the threshold single flight
the lower wing surface when it was found that probability of failure for the intact structure is
the rear spar chord in the center section was 10-7. The USAF has determined the threshold
severed and there were adjacent wing skin for the conditional single flight probability of
cracks. This aircraft had 12,400 flight hours. failure through their perception of the discrete
Further teardown inspections of wings that had source damage threat. In the case of the C-5A,
been in service 8,000 to 10,000 hours revealed they assumed the probability of discrete source
that there were aircraft in the fleet that were -3
damage was 10 [12]. For the case of the 707
exhibiting more WFD than that found in the -4
they assumed it was 10 [11].
population examined by Meadows. One of the primary inputs to the risk
Consequently, the recommendation was made assessment approach to determine the onset of
that the lower wing surface should be replaced the time to WFD is the distribution of cracks in
between 8,000 and 9,000 flight hours and the structure. The USAF has determined this
restrictions should be placed on aircraft that distribution through teardown inspections of
were operating above 8,500 flight hours. The full-scale fatigue test articles or operational

442.8
 EFFECT OF AIRCRAFT FAILURES ON USAF STRUCTURAL REQUIREMENTS

aircraft. They believe this is the best method damage. This was the case, for example, for the
currently available to obtain the data required to KC-135 and the C-5A. The application of the
derive the probability distribution function for risk assessment technology to the case of
equivalent initial cracks in the critical areas of multiple site damage is very much the same as it
the structure. The word "critical" here refers to is for the case of multiple element damage. In
an area that could significantly contribute to the the case of multiple site damage there will
probability of failure. typically be a "boundary" that will determine if
The probabilistic approach also requires the cracking has the potential to become
the stress density function for each critical area catastrophic. For example in the case of the
is determined. The USAF derives this function fuselage lap splice, the boundary would be the
from the available usage information generated crack stopper built into the structure at the
by their individual aircraft tracking programs. frame or between the frames and its surrounding
The desired stress density function is the one for structure. This crack arrest feature protects the
a single flight of an aircraft selected at random. integrity of the structure. The condition of the
The structural analyst can easily derive this crack stopper and its surrounding structure (that
function from the stress exceedance function is, the boundary) will determine if the damage
developed as a part of the deterministic damage could propagate to catastrophic failure.
tolerance analysis. One can then compute the Therefore, the interest is primarily in the
joint probability distribution of cracks and stress degradation of the boundary with time and not
and integrate this function over the point set the growth of the holes in the lap splice to link-
where the crack size has reached critical length. up. Therefore, multiple site damage may be
The result of this calculation is the single flight evaluated in the same manner as multiple
probability of failure. The time at which the element damage. Lockheed [13] demonstrated
probability of failure is unacceptable is the onset an example this of this in their risk assessment
of WFD. on of the inner to outer wing joint of the C-141
Therefore, the USAF considers the cracks aircraft.
in the structure and the stresses at the critical Emphasis must be placed on the detection,
locations as random number sets. The crack through nondestructive evaluation, of cracks
growth function and the residual strength that could be significant for determination of the
function are also random functions because of onset of WFD. As indicated above, there is a
the intrinsic variability of the material need to make an estimate of this onset based on
properties. Fortunately, the variability of the probabilistic assessment of cracking data
crack growth and residual strength functions derived from the teardown inspection of fatigue
does not appear to have a major impact on the test articles or operational aircraft. The analyst
risk of failure. Therefore, the analyst uses his must recognize, however, that this is only an
best estimate of the mean of these functions in estimate. It is not realistic to expect analyses to
the risk assessment. determine this time with great accuracy even
The damage scenarios in an airplane that with the most sophisticated fracture mechanics
could constitute WFD differ depending on programs. The actual time may be either
location in the aircraft. However, typically, somewhat earlier or later than this estimate. It
they fall into two categories. The first of these is important, therefore to be able to validate this
is multiple site damage - characterized by cracks prediction with nondestructive evaluation. This
in multiple details in the same structural is difficult because the size of defect the
element. The second is multiple element inspector must find is quite small. As indicated
damage where there are cracks in multiple above, the experimental evidence to date
structural elements. indicates cracks of the order of one millimeter
Previous efforts have shown the analyst can significantly lower the fail-safety capability
can readily apply this type of analysis to the of certain structural configurations.
structures where the concern is multiple element

442.9
 John W. Lincoln

5 Conclusions References
The USAF ASIP as originally conceived after [1] Swift T. Damage Tolerance in Pressurized Fuselages.
the B-47 failures did not accomplish its goal of 14th Symposium of the International Committee on
Aeronautical Fatigue. 11th Plantema Memorial
ensuring safety of operational aircraft. They
Lecture, Ottawa, Canada, pp. 1-77, 1987.
learned that the use of the reliability approach
[2] Department of the Air Force. Aircraft Structural
they adopted, led to catastrophic loss of aircraft Integrity Program, Airplane Requirements. Military
and was a large economic burden to correct Standard MIL-STD-1530A, 1975.
mistakes made. In hindsight, they realized that [3] Negaard G. R. The History of the Aircraft Structural
an accurate determination of the reliability Integrity Program. Aerospace Structures Information
could not be ascertained through this approach. and Analysis Center (ASIAC) Report No. 680.lB,
1980.
In response to the problems with probabilistic
[4] Lloyd D. K. and Lipow M. Reliability: Management
methods for ensuring safety, they moved into a Methods and Mathematics. Second Edition, Prentice
more deterministic approach with the adoption Hall, 1962.
of damage tolerance. However, damage [5] Lincoln J. W. Risk Assessments of Aging Aircraft.
tolerance is not completely removed from Proceedings of the First Joint DOD/FAA/NASA
probabilistic methods. The reason is that the Conference on Aging Aircraft, Ogden, Utah, July
approach requires that determination of the 1997.
initial flaw size for the damage tolerance [6] Impellizzeri L. F., Siegel A. E., McGinnis R. A.
Evaluation of Structural Reliability Analysis
calculations and, in addition, the inspection Procedures as Applied to a Fighter Aircraft.
capability is based on a probability of detection Technical Report AFML-TR-73-150, September
of 0.9 with a 95 percent confidence. Experience 1973.
has shown that damage tolerance inspections [7] Wood H. A. USAF Approach to Structural Life
may not preclude widespread fatigue damage in Management. Proceedings of an International
an aircraft. The most logical approach to Symposium on the Role of Design, Inspection, and
Redundancy in Marine Structural Reliability,
determine when in the life of an aircraft when National Academy Press, 1984.
this problem occurs is to use probabilistic [8] Coffin M. D. and Tiffany C. F. New Air Force
methods. Consequently, probabilistic methods Requirements for Structural Safety, Durability, and
have an extremely important role to play in Life Management. AIAA Journal of Aircraft, Volume
achieving safe and economic operation of an 13, No. 2, 1976.
aircraft. However, their limitations must be [9] Lincoln J. W. Damage Tolerance - USAF
Experience, Proceeding of the 13th Symposium of the
clearly understood so that they will be used
International Committee on Aeronautical Fatigue,
appropriately. Pisa, Italy, pp 265-295, 1985.
On the positive side, one could conclude [10] Lincoln J. W. Risk Assessment of an Aging Military
from the examples that the USAF does learn Aircraft. Journal of Aircraft, Volume 22, Number 8,
from its mistakes. On the negative side, one 1985.
could conclude that it takes a major catastrophic [11] Lincoln J. W. Aging Aircraft - USAF Experience
failure or an economic disaster to make the And Actions. Proceedings of the 19th Symposium of
the International Committee on Aeronautical
USAF act. A common thread among all of the Fatigue, 16th Plantema Memorial Lecture,
failures is that structural integrity is very fragile, Edinburgh, Scotland, pp 3-38, 1997.
and mistakes can compromise it quite easily. [12] Lincoln J. W. Risk Assessments-USAF Experience.
Usually, the reason for mistakes is that the Proceedings of the International Workshop on
designer is unaware of the threats to structural Structural Integrity of Aging Airplanes, Atlanta, GA,
integrity or does not consider them in the design March 31 - 2 April 1992.
process. The USAF is fortunate to have [13] Alford R. E., Bell R. P., Cochran J. B., and
formalized the current version of the ASIP. Hammond D. O. C-141 WS 405 Risk Assessment.
This process, when followed, has been the key WL-TR-92-4045, Proceedings of the 1991 USAF
Structural Integrity Program Conference, San
to virtual elimination of failures from strength,
Antonio, Texas, 1992.
stiffness, or fatigue causes.

442.10